Falhas do tipo CWE-73

768 resultados

Controle de acesso inadequado

A aplicação falha em validar ou enforçar corretamente quem pode acessar quais recursos ou funcionalidades. Isso permite que usuários não autorizados executem ações, visualizem dados sensíveis ou acessem áreas administrativas que deveriam estar restritas.

Exemplo

Um sistema bancário que valida se o usuário está logado, mas não verifica se ele tem permissão para acessar a conta de outro cliente — bastaria mudar o ID na URL (ex: `/conta/123` para `/conta/456`) para ver dados alheios.

Como mitigar

Implemente verificações de autorização em todas as operações sensíveis, não confie apenas em obscuridade de URLs ou IDs. Use listas de controle de acesso (ACL) ou papéis (RBAC) centralizados, e valide permissões no servidor antes de retornar qualquer dado ou executar ação.

CVE-2025-0109MEDIUMPAN-OS: Unauthenticated File Deletion Vulnerability on the Management Web InterfaceEPSS 0.6%CVE-2025-65115HIGHRemote Code Execution Vulnerability in JP1/IT Desktop Management 2 and JP1/NETM/DMEPSS 0.6%CVE-2025-29708CRITICALSourceCodester Company Website CMS 1.0 contains a file upload vulnerability via the "Create Services" file /dashboard/Services.EPSS 0.6%CVE-2025-29709CRITICALSourceCodester Company Website CMS 1.0 has a File upload vulnerability via the "Create portfolio" file /dashboard/portfolio.EPSS 0.6%CVE-2026-35593MEDIUMTrilium Notes has Local File Inclusion via upload modified file API endpointEPSS 0.6%CVE-2026-40421MEDIUMMicrosoft Word Information Disclosure VulnerabilityEPSS 0.6%CVE-2026-39907HIGHUnisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via WCF SOAPEPSS 0.6%CVE-2025-52465HIGHGeoServer has an arbitrary file write vulnerability in its Master Password Dump PageEPSS 0.6%CVE-2026-72841CRITICALluci-app-openvpn Path Traversal RCE via instance_name2EPSS 0.6%CVE-2026-14480HIGHOpenPLC v3 External Control of File Name or PathEPSS 0.6%CVE-2026-72842CRITICALOpenWrt luci-app-lxc ACL Inconsistency Authentication BypassEPSS 0.6%CVE-2026-55477HIGHAuthenticated Arbitrary File Write via Database Import and Xray Log Path ManipulationEPSS 0.6%CVE-2022-42893HIGHA vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usiEPSS 0.6%CVE-2026-62804HIGHMicrosoft Word Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-92189CRITICALQuest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-58293HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-85668HIGHXinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-registerEPSS 0.6%CVE-2024-2150MEDIUMSourceCodester Insurance Management System file inclusionEPSS 0.6%CVE-2024-37295HIGHAimeos Core remote code execution in web server contextEPSS 0.6%CVE-2022-42891HIGHA vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service usiEPSS 0.6%